datadog-analysis

Analyze Datadog logs, metrics, and APM data using statistics-first investigation scripts.

Updated Mar 26, 2026
One-click install
npx skills add https://github.com/erwinv2k-TKG/AgentesVSC --skill datadog-analysis-erwinv2k-tkg
Or copy as Structured Prompt for Agent
Please help me install this Agent Skill.
Skill: datadog-analysis
Source: https://github.com/erwinv2k-TKG/AgentesVSC/tree/main/packs/incidentfox/sre-agent/.claude/skills/observability-datadog
Command: npx skills add https://github.com/erwinv2k-TKG/AgentesVSC --skill datadog-analysis-erwinv2k-tkg

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires httpx, and includes scripts (resource) components.

What problem does it solve? Investigating production incidents in Datadog often leads to dumping raw logs without context, wasting time and missing root causes. This Skill enforces a statistics-first workflow that surfaces error rates, top patterns, and actionable recommendations before any log sampling. ## Core Features & Use Cases - Statistics-First Investigation: The get_statistics.py script aggregates log volume, error rates, status distribution, top services, and normalized error patterns as a mandatory first step. - Strategic Log Sampling: The sample_logs.py script supports errors_only, warnings_up, around_time, and all strategies for targeted log retrieval with time windows and limits. - Query Syntax Reference: Built-in Datadog Query Language (DQL) and metrics query syntax for filters, facets, aggregations, and APM percentiles. - Use Case: During an incident on the payment service, run get_statistics.py to see a 12% error rate and the top error pattern, then sample errors around the spike timestamp to identify the root cause. ## Quick Start Ask the agent to investigate errors in the payment service over the last hour using the Datadog statistics script.

Frequently Asked Questions about datadog-analysis

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I investigate Datadog logs during an incident?

Start with get_statistics.py to get total volume, error rate, status distribution, and top error patterns. Then use sample_logs.py with a strategy like errors_only or around_time to inspect relevant log entries without dumping raw data.

How do I query Datadog logs by service and status?

Use Datadog Query Language filters such as service:payment status:error, combined with AND or OR operators. You can also filter by facets like env:production or attributes like @http.status_code:>=500.

Does this work with different Datadog sites like EU or US5?

Yes, set the DATADOG_SITE environment variable to your site, such as us5.datadoghq.com or datadoghq.eu. The client builds the API URL from the site, or uses DATADOG_BASE_URL when running through a credential proxy.

Why does the script say credentials are not visible in environment variables?

In production, credentials are injected transparently by a proxy layer, so DATADOG_API_KEY is not directly visible. For direct testing mode, you must set DATADOG_API_KEY and optionally DATADOG_APP_KEY yourself.

What are the limitations of the log sampling strategies?

The Datadog API caps results at 1000 logs per request, and the scripts default to 50. The around_time strategy requires an ISO timestamp and filters client-side within the specified window, so very high-volume periods may need narrower windows.